Discovery Security Concerns

[kurtdean]

Hi All,

Some of my business units are concerned that allowing authenticated discovery will create a massive vulnerability in the following scenario:

• A malicious user gains access to our instance with an administrative or other powerful role
• A custom probe is created containing dangerous code that can be executed on one or more hosts. It could delete everything on a file system, or steal data, or anything you can imagine doing with malicious code.
• The discovery is kicked off by this user and the code executes, causing mayhem and world war three.

My answer to this risk includes mitigating controls:

• Access to our SN instance requires MFA, reducing the likelihood of an outside attack.
• Administrative roles able to create and execute discovery are limited, and actions are logged.
• Accounts used for discovery should be limited in what they are able to do. Sudo is required to return many useful results, but accounts can be limited to running specific commands.

I'm sure we can lock it down further by only providing the service account during discovery, and removing it or changing the password each time, but this will add overhead to the process.

My questions:

• Is the scenario above realistic?
• Are there other approaches to mitigate this risk not mentioned?
• Is there a comprehensive guide to creating hardened service accounts for discovery that we can reference?

Thanks!

Kurt

[danjohnson]

Have you also had a look through the Instance Hardening Guide?

[kurtdean]

Thanks everyone for their input. All of the suggestions are good stuff, but I think in order to satisfy these concerns we need some kind of "offline" discovery.

Are there any solutions that can run standalone without communicating with the instance? We need something that will run and capture assets locally to a database that can be exported and then separately imported to the CMDB.

[bernyalvarado]

Hi Kurt, indeed. There are many option out there. Even using something as basic as nmap is an option

Thanks,

Berny

[bernyalvarado]

I hope that helps

[d_hertel]

Yes, there are a variety of off-line scanning solutions that could collect HW/SW data (completely separate from Disco of course).   And then the results imported via an integration job.     A company I recently heard about for this type of scenario is https://opmantek.com/       I haven't used it but it maybe worth checking out....

If you do try it, please reply I'd be curious to hear your experience